diff options
| author | Danish Prakash <contact@danishpraka.sh> | 2025-10-30 16:19:13 +0530 |
|---|---|---|
| committer | Stefano Brivio <sbrivio@redhat.com> | 2025-11-04 18:49:43 +0100 |
| commit | 1d164396397799088b6dad13178781553333f2aa (patch) | |
| tree | dc5fa5e442bfa8b32803f6bd8b6f6f5795c9d69a | |
| parent | f6b6118fcabda6d6a89a4a16dfee151ab97f1d7a (diff) | |
| download | passt-1d164396397799088b6dad13178781553333f2aa.tar passt-1d164396397799088b6dad13178781553333f2aa.tar.gz passt-1d164396397799088b6dad13178781553333f2aa.tar.bz2 passt-1d164396397799088b6dad13178781553333f2aa.tar.lz passt-1d164396397799088b6dad13178781553333f2aa.tar.xz passt-1d164396397799088b6dad13178781553333f2aa.tar.zst passt-1d164396397799088b6dad13178781553333f2aa.zip | |
contrib/selinux: use regex instead of SELinux template
It might be possible to avoid using SELinux template (%USERID),
and instead using regex to match user ids. This would allow
discarding the explicit restorecon call while during package builds[1].
Original suggestion from cathy.hu@suse.com:
> running restorecon would be unnecessary if the passt upstream selinux
> module would not use ${USERID} in pasta.fc (gets converted to [0-9]+ anyway)
[1] - https://passt.top/passt/commit/?id=e019323538699967c155c29411545223dadfc0f5
Signed-off-by: Danish Prakash <contact@danishpraka.sh>
Reviewed-by: Max Chernoff <git@maxchernoff.ca>
Tested-by: Max Chernoff <git@maxchernoff.ca>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
| -rw-r--r-- | contrib/fedora/passt.spec | 11 | ||||
| -rw-r--r-- | contrib/selinux/pasta.fc | 12 |
2 files changed, 6 insertions, 17 deletions
diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec index 663289f..d1bcf4a 100644 --- a/contrib/fedora/passt.spec +++ b/contrib/fedora/passt.spec @@ -103,17 +103,6 @@ fi %posttrans selinux %selinux_relabel_post -s %{selinuxtype} -# %selinux_relabel_post calls fixfiles(8) with the previous file_contexts file -# (see selabel_file(5)) in order to restore only the file contexts which -# actually changed. However, as file_contexts doesn't support %{USERID} -# substitutions, this will not work for specific file contexts that pasta needs -# to have under /run/user. -# -# Restore those explicitly, hiding errors from restorecon(8): we can't pass a -# path that's more specific than this, but at the same time /run/user often -# contains FUSE mountpoints that can't be accessed as root, leading to -# "Permission denied" messages, but not failures. -restorecon -R /run/user 2>/dev/null %files %license LICENSES/{GPL-2.0-or-later.txt,BSD-3-Clause.txt} diff --git a/contrib/selinux/pasta.fc b/contrib/selinux/pasta.fc index e60c614..82dbcbe 100644 --- a/contrib/selinux/pasta.fc +++ b/contrib/selinux/pasta.fc @@ -12,11 +12,11 @@ /usr/bin/pasta.avx2 system_u:object_r:pasta_exec_t:s0 /tmp/pasta\.pcap system_u:object_r:pasta_log_t:s0 /var/run/pasta\.pid system_u:object_r:pasta_pid_t:s0 -/run/user/%{USERID}/netns system_u:object_r:ifconfig_var_run_t:s0 -/run/user/%{USERID}/containers/networks/rootless-netns system_u:object_r:ifconfig_var_run_t:s0 +/run/user/[0-9]+/netns system_u:object_r:ifconfig_var_run_t:s0 +/run/user/[0-9]+/containers/networks/rootless-netns system_u:object_r:ifconfig_var_run_t:s0 # In case XDG_RUNTIME_DIR is not set (i.e. no systemd user session) Podman falls # back to a location under /tmp -/tmp/storage-run-%{USERID}/netns system_u:object_r:ifconfig_var_run_t:s0 -/tmp/storage-run-%{USERID}/containers/networks/rootless-netns system_u:object_r:ifconfig_var_run_t:s0 -/tmp/containers-user-%{USERID}/netns system_u:object_r:ifconfig_var_run_t:s0 -/tmp/containers-user-%{USERID}/containers/networks/rootless-netns system_u:object_r:ifconfig_var_run_t:s0 +/tmp/storage-run-[0-9]+/netns system_u:object_r:ifconfig_var_run_t:s0 +/tmp/storage-run-[0-9]+/containers/networks/rootless-netns system_u:object_r:ifconfig_var_run_t:s0 +/tmp/containers-user-[0-9]+/netns system_u:object_r:ifconfig_var_run_t:s0 +/tmp/containers-user-[0-9]+/containers/networks/rootless-netns system_u:object_r:ifconfig_var_run_t:s0 |